Zoom shipped an out-of-band update on Monday fixing CVE-2026-5512, a heap corruption bug in the code that decodes shared screen content, and confirmed it had been exploited before the patch. Three law firms were targeted, according to an incident response firm that handled two of the cases and spoke on condition its client names stay private. In each case an attacker joined a meeting as an invited external participant and sent a malformed screen share stream that executed code on other participants' machines. Zoom rated the flaw 8.8 and pushed the update through automatic client updating, which most enterprise deployments allow and some do not.
The technical shape
Screen sharing in Zoom sends compressed frame data that the receiving client decodes in a process with substantial privileges, because it needs to render into the meeting window and handle hardware acceleration. The bug is in the handling of a tile-based update format used for efficient partial screen refreshes: a crafted tile descriptor with an out-of-range dimension caused a heap buffer to be written past its end. The overflow was controllable enough to be exploitable rather than merely a crash.
Exploitation required the attacker to be an accepted participant in the meeting, which is a meaningful constraint and a lower bar than it sounds for law firms that routinely host meetings with opposing counsel, experts, and clients. The attacker in these cases was a legitimately invited external participant, which means no invitation abuse and nothing anomalous in the meeting logs. That is what made detection difficult and what makes this incident worth studying.
How it was found
One of the affected firms had endpoint detection that flagged an unusual child process spawned by the Zoom client during a meeting. That alert sat in a queue for nine days before an analyst looked at it, which the firm's incident report describes with more candor than most. When the analyst did look, the process was a loader that had already established persistence and had been exfiltrating documents related to a specific arbitration matter.
The incident response firm found the same pattern at a second client and, working with Zoom, reproduced the crash from captured network data. Zoom's security team confirmed the vulnerability within 48 hours and shipped the fix eleven days later. Both the response firm and Zoom described the coordination as functional, which is a low bar and one that vendors miss often enough to be worth noting.
The story is rarely the launch. It is what breaks, what ships, and who owns the mess at 2 a.m.
Attribution and targeting
The three targeted firms all work on cross-border commercial disputes involving state-linked entities, which narrows the plausible motive considerably. The incident response firm assessed with low confidence that the operator is a commercial intrusion vendor selling to state clients rather than a state team directly, based on tooling that resembles offerings previously documented in reporting on the spyware market.
Law firms have been a favored target for years for the obvious reason: they hold the same sensitive material as their clients with a fraction of the security investment. The 2016 Panama Papers breach, the 2020 Grubman Shire intrusion, and a steady stream of ransomware incidents have not produced a corresponding change in how the sector defends itself. Several large firms now run credible security programs. The mid-market does not.
What organizations should do
Update immediately, and verify the update actually applied, because Zoom client updating is inconsistent in managed environments where administrators have disabled automatic updates and then not built a reliable alternative. Zoom's admin dashboard reports client versions across an organization and is the fastest way to find machines that missed it.
Beyond the patch, the structural lesson is about external participants. A meeting platform that lets any invited participant send data that a privileged process parses is an attack surface, and this will not be the last bug of this shape in any of these products. Organizations handling sensitive matters should consider whether external participants need screen sharing rights at all, which Zoom allows administrators to restrict per meeting and which almost nobody configures.
The broader pattern in collaboration software
Zoom, Teams, Slack, and Webex all parse untrusted rich content in privileged processes: screen frames, embedded previews, file thumbnails, and rendered documents. Each of those parsers is written in memory-unsafe code in most cases, and each has produced vulnerabilities. Zoom has invested in rewriting parts of its media stack in Rust and said in its advisory that the affected component is scheduled for that treatment.
The industry-wide fix is sandboxing rather than rewriting, isolating parsers into low-privilege processes so that a memory bug yields nothing useful. Browsers solved this fifteen years ago and collaboration clients have been slow to follow, largely because the performance cost of process isolation for real-time video is real. That is an engineering problem with known solutions and it requires prioritization that arrives after incidents like this one.
The detection side deserves the same scrutiny. In this case an endpoint alert fired correctly and sat in a queue for nine days, which is a failure of triage capacity rather than of tooling, and it is the most common shape of security failure in organizations that have bought good products. A firm with a nine day alert backlog does not have a detection problem; it has a staffing problem that no additional product will fix. The uncomfortable question for any security leader reading this incident is how long their own high-severity alerts wait, and whether anyone measures it.
Skarvonix will keep following this beat with reporting grounded in how systems behave outside the launch keynote.
- Zero Trust
